ClawHub
Back to skill

Security audit

Stock Alert

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: it checks stock prices, stores user-selected alert rules locally, and can optionally run scheduled alert checks after user approval.

Install this only if you are comfortable sending queried or monitored stock symbols to Sina Finance and storing your watchlist and alert thresholds in local home-directory files. If you enable scheduled checks, make sure you know how to remove the scheduled job later, since the skill does not document a cancellation command.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Note
Location
scripts/stock_monitor.py:27
Finding

Monitoring Configuration Stored Without Enforced Restrictive Permissions

Content
View full analysis

Vulnerability Details

File Location: scripts/stock_monitor.py:7, 27-29
Vulnerability Type: Plaintext sensitive data stored with environment-dependent permissions
Risk Level: Low

Vulnerable Code

python
CONFIG_FILE = os.path.expanduser("~/.stock_alert_config.json")
python
def save_config(config):
    with open(CONFIG_FILE, "w") as f:
        json.dump(config, f, ensure_ascii=False, indent=2)

Technical Analysis

The monitoring configuration contains stock symbols, names, and user-selected price or percentage thresholds. save_config() writes this information as plaintext using the default permissions determined by the process umask. It neither creates the file with an explicit restrictive mode such as 0600 nor corrects the permissions of an existing file.

On systems with a permissive umask, shared home-directory access, or preexisting configuration files with weak permissions, another local account may be able to read the user's monitoring configuration. Exploitation requires local filesystem access and sufficient directory traversal permissions; the code does not create a remote disclosure path.

Attack Path

  1. The user invokes the add action and supplies a stock code and alert thresholds.
  2. save_config() creates or overwrites ~/.stock_alert_config.json using permissions inherited from the process environment or retained by an existing file.
  3. On a shared system where those permissions allow access, another local user locates the predictable configuration path.
  4. The local user reads the file and learns the monitored securities and alert thresholds.

Impact Assessment

Successful exploitation provides read access only to the financial monitoring metadata present in the configuration file. It may expose the user's investment interests and possible trading thresholds. This issue does not itself provide code execution, privilege escalation, account credentials ...[truncated 115 chars]

Remediation
View remediation

Remediation Suggestions

  • Create the configuration file atomically with owner-only mode 0600, for example by using os.open() with O_CREAT | O_WRONLY | O_TRUNC and an explicit mode.
  • Apply os.chmod(CONFIG_FILE, 0o600) to existing files before or after writing so earlier permissive permissions are corrected.
  • Prefer storing application state in a dedicated user-only directory created with mode 0700.
  • Write updates to a securely created temporary file in the same protected directory, flush and synchronize it, then atomically replace the destination.
  • Validate that the destination is a regular file owned by the current user before overwriting it, reducing risks from unsafe preexisting paths or symbolic links.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

This is substantively the same mismatch issue as the prior TP4 finding: declared behavior does not fully cover external network use and persistent alert-processing behavior. Such mismatches reduce transparency and weaken policy enforcement because the runtime and user may not anticipate all side effects.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This is substantively the same mismatch issue as the prior TP4 finding: declared behavior does not fully cover external network use and persistent alert-processing behavior. Such mismatches reduce transparency and weaken policy enforcement because the runtime and user may not anticipate all side effects.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
86% confidence
Finding

This duplicate finding points to the same unsafe file-deletion behavior. Repeating a destructive shell command in skill content increases the chance an agent will execute it without proper validation or safety checks.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

· 腾讯 -5.3% — 超过你设的 5% 阈值

text

然后删掉文件（`rm ~/.stock_alerts_pending.json`），再继续回答用户问题。

---

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
86% confidence
Finding

This duplicate finding points to the same unsafe file-deletion behavior. Repeating a destructive shell command in skill content increases the chance an agent will execute it without proper validation or safety checks.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

· 腾讯 -5.3% — 超过你设的 5% 阈值

text

然后删掉文件(`rm ~/.stock_alerts_pending.json`),再继续回答用户问题。

---

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill explicitly performs network access to Sina Finance and writes persistent local files, but declares no corresponding tool scope or permissions. This creates a trust and containment gap: hosts or users cannot accurately understand or restrict the skill's data egress and file-write behavior before execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language instructions, triggers, examples, and outputs are presented only in Chinese, which effectively forces a specific language for use of the skill. The file does not offer opt-in language selection or explain that the skill is intentionally restricted to a Chinese-language or region-specific audience.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script transmits user-supplied stock symbols to Sina's external quote service, which is a real data egress behavior. While stock tickers are usually low-sensitivity data, in this skill context they can still reveal a user's watchlist, portfolio interests, or trading intent, and the code provides no disclosure, consent, or option to avoid the third-party request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The check path transmits the user's configured stock symbols to Sina's external quote API every time alerts are evaluated, but the code provides no disclosure or consent at that point. While stock codes are usually low-sensitivity data, a watchlist can still reveal a user's investment interests or portfolio monitoring behavior to a third party.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.